PHP security
ive been reading an article on php security but i still have the following questions:
1) should i place my connect file(for php scripts) somewhere other then public html?
2) is it normal that users can access files if they know the exact name when i have set index as forbidden?
3) my htaccess file has some ban list which looks like the following:
RewriteEngine On
RewriteCond %{HTTP_USER_AGENT} ^BlackWidow [OR]
RewriteCond %{HTTP_USER_AGENT} ^Bot\ mailto:craftbot@yahoo.com [OR]
RewriteCond %{HTTP_USER_AGENT} ^ChinaClaw [OR]
RewriteCond %{HTTP_USER_AGENT} ^Custo [OR]
RewriteCond %{HTTP_USER_AGENT} ^DISCo [OR]
RewriteRule ^.* - [F,L]
i didn't past the whole ban list, but my question is there something i should include in my htaccess to prevent attacks?
4) what files should be placed in public html and what shouldn't?
5) do password protected directories actually work? and when should they be used?
6) i am already validating my users using sessions, stripping slashes/html characters, and encrypting passwords should i be doing anything else?
7) any genereal suggestions on how to secure my files/web server?
|